Technique

TTL manipulation

technique:ttl_manipulation Also: change the TTL

Changing the packet TTL so the rogue device resembles a Windows workstation when probed.

Explore relationships

Mentioned in

Relationships

Direction Predicate Other entity Origin EP
incoming USES Carl Explicit 41

Claims

Carl USES TTL manipulation

Carl changed the TTL so the device would appear to be a Windows workstation rather than Linux.

Explicit Confidence 99% · Carl EP 41 Details

“Then I’ll also change the TTL so if I’m pinged, I’ll also look like a Windows workstation”